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National Records of Scotland Privacy Notice 


Introduction 


This privacy notice tells you what to expect when National Records of Scotland 
(NRS) collects personal information. It applies to information we collect when you: 


e visit our websites (including cookies, IP addresses, hostnames and search 
engine) 

use our social media channels (Facebook, Twitter and WordPress) 

phone, email or make a complaint to us 

take part in Scotland’s Census 

visit our search rooms 

apply for a job, hold or have held a job with NRS 

want to access your personal information 


It also explains when and how we disclose personal information. 


This privacy notice covers this website (www.nrscotland.gov.uk) and the following 
websites which are managed by NRS: 


NRS Web Archive: https://webarchive.nrscotland.gov.uk/ 
Scottish Documents: http://www.scottishdocuments.com/ 


Scottish Handwriting: http://www.scottishhandwriting.com/ 
Scottish Archives for Schools (SAFS): http://www.scottisharchivesforschools.org/ 


Scottish Archives Network (SCAN): http://www.scan.org.uk/ 

Data Controllers 

The data controllers for NRS are the Registrar General for Scotland and the Keeper 
of the Records of Scotland. They can be contacted via our Data Protection Officer, 
whose address is at the end of this notice. 

Websites 

Information collected by the NRS website 


Information that is routinely collected by this website falls mainly into two categories: 
feedback forms and website log files. 


Feedback forms 


The website provides a feedback form to allow users to: 
e Give general feedback about the site 


e Make an enquiry relating to the different functions of NRS 
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e Make a Freedom of Information request 
e Report technical problems with the site 
e Request a business contact with NRS 


The information collected will be stored and used by NRS chiefly for the purpose of 
fulfilling the stated service. 


We will not share any personal information that we receive about individuals with 
other organisations for commercial purposes, or use it for any marketing purposes 
which individuals have not consented to. 


We reserve, however, the right to use non-personal information for business, 
research and marketing purposes. In these cases the reuse of the information will 
not identify or be associated in any way with the individual who provided it and will 
not contain any contact information relating to that individual or their company. 


Possible reuses of non-personal information may include (but are not limited to): 


e A report made publicly available on the site listing all the Freedom of Information 
queries made in a given period 


e Publication of previous Freedom of Information (FOI)/Environmental Information 
Regulations (EIR) releases 


e An internal report produced for NRS staff listing any technical problems that have 
arisen with the website and steps taken to remedy them 


e Marketing literature using quotes drawn from feedback given about the site 


You do not need to include your name or contact details in order to provide us with 
general feedback or information about any technical problems you may encounter. 
You will, however, need include an email address if you want us to reply to you. We 
will only use your email address to reply to you and not for any other purpose. For 
some enquires contact details will be required. A Freedom of Information request, for 
example, will only be valid if a contact name and email or other contact address are 
provided. 


Information collected from the feedback/contact form is not stored on the website, 
but is instead emailed to an internal service desk system accessible only by 
authorised NRS staff. We use a relay service to scan emails for spam and malware 
before they reach the service desk system. Please be aware that the 
feedback/contact form is not intended for the transmission of confidential or security- 
related material and should not be used for this. Emails that you send us, and those 
that we may send to you, are not secure because email messages can be 
intercepted. 


Website log files 


All websites produce log files that record the activity on that site. Log files record 
which pages on the site have been accessed and how many times. From this 
information it is possible to produce statistics such as how busy a website is, which 
pages are the most popular and whether there are any broken links. 
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Log files typically record the IP address and/or hostname of all users accessing the 
website. This allows us to distinguish between different users and therefore estimate 
the number of unique visitors to our websites. IP addresses and hostnames are not 
linked to any individual's personally identifiable information. 


Specific IP addresses and hostnames will not be made publicly available. They will 
only be used by website log file software to compile overall summary statistical 
reports on the performance of our websites. 


Website log files are stored securely on the websites using good industry practice for 
safeguarding information and server functions. 


Cookies and Google Analytics 


To gather information about how people use this site (https://www.nrscotland.gov.uk) 
and the other websites covered by this privacy notice we use Google Analytics. The 
information collected helps us investigate whether each website meets its users’ 
needs as well as to evaluate how each website can be improved. Google Analytics 
stores information about what pages you visit, how long you are on the site, how you 
got here and what you clicked on. We do not collect or store your personal 
information (e.g. your name or address) so this information cannot be used to 
identify who you are. We do not allow Google to use or share our analytics data. 


Use of cookies by NRS 


Websites may be allowed, depending on your browser settings, to create and store 
small files in a specific directory on your computer to help with the functionality of the 
site. These files are called 'cookies' and cannot harm your computer. Only the 
website that created the cookie can subsequently reuse it. 


There are two types of cookies: 

* Session Cookies - these are temporary cookie files, which are erased when you 
close your browser. When you restart your browser and go back to the site that 
created the cookie, the website will not recognize you. 

e Persistent Cookies - these remain on your computer for a period of time to allow a 
website to recognise you when you return and present you with the appropriate 
customised pages 


Cookies used by the National Records of Scotland website are as follows: 























Cookie Typical content Expires 

_utma randomly generated 2 years 
number 

_utmb randomly generated 30 minutes 
number 

_utmc randomly generated when user exits browser 
number 

_utmz randomly generated 6 months 
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number + info on how the 
site was reached (e.g. 
directly or via a link, 
organic search or paid 
search) 











For further details on the cookies set by Google Analytics, please refer to the Google 
Code website. 


Search engine 


The NRS website uses a search engine which is part of Drupal core. No user- 
specific data is collected or used by our website search facility. 


Security and performance 


NRS uses a third party service to help maintain the security, performance and 
availability of our websites. IP addresses of visitors to the NRS website are 
processed to deliver this service. The information collected is not linked to any 
individual's personally identifiable information. 


IP addresses and hostnames 


An IP address is the numeric address of a computer. The IP address recorded on 
website log files is the address provided by your internet service provider's 
equipment and not your own personal computer's address. 


Hostnames are similar in appearance to the domain names you see in URLs and 
email addresses. The hostnames recorded on website log files are those of the 
internet service provider's equipment that you are using to access the internet, and 
not your own computer's name or location. 


Your internet service provider will keep records of which customer is using any IP 
address or hostname at any given time, and so it is theoretically possible to trace 
back activity shown on any website log file to a specific individual. In practice, this 
can only be done with the explicit involvement of the internet service provider, and 
such a trace would therefore only take place in the event of serious criminal misuse 
of the internet and would be carried out by the police. 


NRS will not attempt to associate IP addresses and hostnames with individuals. In 
the event of serious criminal misuse of the website, the matter would be referred to 
the police for investigation. 

Social Media 

WordPress 

Our blog “Open Book’ is run via a third party service called WordPress.com. To 


monitor and report on the current usefulness of our blog and to help us improve it, 
we use a Standard WordPress service. This collects anonymous information about 
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users' activity on the site, such as, for example, the number of users viewing pages 
on the site. In addition, WordPress requires visitors wishing to post a comment to 
provide a name and email address. WordPress.com is run by Automattic Inc. For 
additional information about how WordPress processes data, please see 


Automattic's privacy notice. 


When you contact us via Twitter 


NRS uses Hootsuite, a third party provider, to manage its social media interactions. 
Hootsuite stores messages sent by you via social media for three months. These will 
not be shared with any other organisations. 


When you contact us via phone, email or make a complaint 
When you phone NRS 


We do not collect caller line identification information when you call us. We will only 
collect personal information that you consent to provide to us in order to deliver a 
service. 


When you email NRS 


When you contact us via email, we will retain your email and our response to it for 
business reasons usually for no longer than 5 years. Thereafter the information will 
be confidentially destroyed. 


When you make a complaint to us 


When you make a complaint to us, we ask for your full name and address as well as 
for as much detail about the complaint as possible. This information is stored in a file 
which is restricted to specific staff handling the complaint within NRS. We retain the 
material for 5 years and destroy it thereafter confidentially. 


In most cases we will have to disclose the complainant's identity to whoever the 
complaint is about in order to resolve the matter. If a person making a complaint 
would prefer to stay anonymous, we will do our best to ensure this, but it may not be 
possible to handle a complaint on an anonymous basis. 


When you take part in the Census 


The information contained in Scotland's Census is vital to help shape Scotland's 
future by informing key decisions on how services such as transport, housing, 
schools and hospitals are planned. You can find out more about how we protect the 
confidentiality of census data, and ensure transparency and confidence, in the 
privacy section on the Scotland’s Census website. 


When you visit our search rooms 


More information on visiting our search rooms can be obtained on the dedicated 
NRS website pages for the Historical Search Room, the Legal Search Room and the 
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ScotlandsPeople Centre. We only collect personal information which will help us to 
deliver a service. Once the business use has passed, we will destroy this data 
confidentially. 


When you use our other services 


Scotlands People 


ScotlandsPeople website is the official Scottish Government site for searching 
government records and archives and is owned, operated and managed by NRS. 
The ScotlandsPeople Privacy Notice tells you what happens to personal information 
we collect and use. 


Registration 


NRS administers the registration of life events such as births, deaths, marriages, civil 
partnerships, divorces and adoptions. The Registration Privacy Notice tells you what 
happens to personal information when a life event is registered. 


Employment with NRS 


When you apply for a position at NRS we will only use the information you supply to 
process your application. We will inform you beforehand if we want to disclose 
information to a third party, for example, where we want to take up a reference or 
obtain a ‘disclosure’, unless the disclosure is required by law. 


We will hold personal information about unsuccessful candidates for 12 months after 
the recruitment process has been completed. Thereafter they will be confidentially 
destroyed. 


If you take up a position in NRS, we will create a personnel file relating to you which 
will be only accessible to restricted staff. Once your employment has been 
concluded, we will retain the file for 10 years in accordance with the requirements of 
our retention schedule and then confidentially destroy it. 


Complaints or queries about our use of personal information 


NRS takes any complaints we receive about how we collect and use personal 
information very seriously, as we try to meet the highest standards in this regard. If 
you think that we collect or use information unfairly, misleadingly or inappropriately, 
please contact us and bring this to our attention. We also welcome any thoughts and 
suggestions for improving our procedures. 


You also have the right to report your concerns to the Information Commissioner's 
Office (ICO). For more information visit the ICO website: https://ico.org.uk/concerns/ 


This privacy notice was drafted with brevity and clarity in mind. It does not provide 
exhaustive detail of all aspects of NRS’s collection and use of personal information. 
More details about how we may use personal information to carry out our functions is 
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provided throughout this website. We are happy to provide any additional information 
or explanation needed. Any requests for this should be sent to the address below. 


Access to personal information 


You can find out if we hold any personal information on you by making a ‘subject 
access request’ under the UK General Data Protection Regulation. If we do hold 
information about you we will: 


e provide you with a description of it; 

e tell you why we are holding it and how long for; 

e tell you who it could be disclosed to; 

e tell you your rights concerning this data; and 

e where possible let you have a copy of the information in an intelligible form. 


A subject access request needs to be made in writing (either by email, letter or by 
using our form). You can find out more about the process of requesting information 
on our dedicated website page. 


We will not provide you with a copy of your personal information if we already make 
it available under a legal obligation (for example birth, death and marriage 
certificates can be ordered as official extracts) or if a restriction on access applies 
(for example census records are closed for 100 years). 


If you find that the information we hold about you is incorrect, you can make a 
request for this to be corrected. In addition, you can ask us to delete the information. 
For some information we hold, however, exemptions apply to rights to rectification 
and erasure. 


Requests to take down content 


You can ask for content to be taken down from our websites. We will only do this in 
certain cases, for example, if it breaches copyright laws, contains sensitive personal 
data, or material that may be considered defamatory or obscene. You will need to 
send us details of the content and explain why you think it should be removed. When 
a valid request is received, the content will be temporarily taken down from public 
view on the website pending the review process. 


Takedown requests are assessed by an NRS Takedown panel composed of staff 
with relevant experience and chaired by a senior manager. All assessments will be 
completed within 30 days of the request being received and we will let you know the 
outcome. Any decision to remove/take down content is at our discretion. This does 
not affect your statutory rights to request information under the Freedom of 
Information (Scotland) Act 2002 and the General Data Protection Regulation. For 
more information please read our Takedown and Reclosure Policy. 
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Disclosure of personal information 


We will not disclose personal data you provide without consent in most cases, but as 
highlighted above, we might need to do so when we investigate a complaint, or want 
to obtain a reference or a ‘disclosure’. We will inform you of this beforehand unless 
the disclosure is required by law, to prevent and detect crime or to produce 
anonymised statistics. 


Links to other websites 


This privacy notice covers the National Records of Scotland, Scotland’s Census, 
Scottish Documents, Scottish Handwriting, Scottish Archives for Schools and 
Scottish Archives Network websites, but does not cover links within these sites to 
other websites. 


Changes to this privacy notice 


We keep our privacy notice under regular review. This privacy notice was last 
updated on 25 January 2022. 


How to contact us 


If you have any questions about how we process personal information or want to 
exercise your rights as a data subject please write to: 


Data Protection Officer 
National Records of Scotland 
HM General Register House 
2 Princes Street 

Edinburgh 

EH1 3YY 


Email: dataprotection@nrscotland.gov.uk 


Further Reading 


Read NRS’s Guide to Information for an overview of our functions and services and 
the information we make routinely available. 


